fileaudit.tar_check module

License MPL-2.0 (C) 2026 Created by Maikel Mardjan - https://nocomplexity.com/ FileAudit - TAR Security Checker

class fileaudit.tar_check.HTTPSOnlyRedirectHandler

Bases: HTTPRedirectHandler

Redirect handler that blocks any redirect to a non-HTTPS URL. Prevents downgrade attacks (e.g. https -> http redirects).

redirect_request(req, fp, code, msg, headers, newurl)

Return a Request or None in response to a redirect.

This is called by the http_error_30x methods when a redirection response is received. If a redirection should take place, return a new Request to allow http_error_30x to perform the redirect. Otherwise, raise HTTPError if no-one else should try to handle this url. Return None if you can’t but another Handler might.

exception fileaudit.tar_check.TarValidationError(message)

Bases: Exception

Custom exception for TAR validation failures in FileAudit.

fileaudit.tar_check.validate_tar(func_or_path=None, max_file_size=None, max_tar_members=None, max_total_extracted_size=None, max_individual_file_size=None, max_filename_length=None, max_directory_depth=None)

Validate TAR files via decorator or direct invocation.

A TAR file validator that can operate in two modes:

1. Decorator mode — wraps a function to validate a TAR file path passed as an argument before the function body runs.

2. Direct call / CLI mode — validates a file immediately and returns a boolean result.

Security checks performed: - File size limits - Tar member count limits - Tar total extracted size limits - Tar individual file size limits - Tar path traversal protection - Reject symlinks/hardlinks/devices/FIFOs - Filename/path length limits - Directory depth limits - Remote files restricted to https:// only

Usage:

@validate_tar @validate_tar() @validate_tar(“custom_arg_name”, max_file_size=5000) validate_tar(“path/to/file.tar”, max_tar_members=100) # CLI usage validate_tar(”https://example.com/file.tar”) # HTTPS only

Parameters:

• func_or_path (callable, str, pathlib.Path, or None) –

  • If a callable: the function to decorate (bare decorator usage: @validate_tar).

  • If a str or Path representing a file path or HTTPS URL: direct validation mode.

  • If a str that is a valid Python identifier: treated as the target argument name in decorator mode.

  • If None: returns a decorator factory.

• max_file_size (int) – Maximum allowed file size in bytes.

• max_tar_members (int) – Maximum number of files/directories in TAR.

• max_total_extracted_size (int) – Maximum total extracted size in bytes.

• max_individual_file_size (int) – Maximum size per extracted file.

• max_filename_length (int) – Maximum filename/path length.

• max_directory_depth (int) – Maximum directory nesting depth.

Returns:

• In decorator mode: the wrapped function.

• In direct call mode: True if validation passes, False if it fails (errors are printed to stdout).

Return type:

Union[callable, bool, function]

Raises:

TarValidationError – If validation fails in decorator mode.